점검 대응긴급KEV 미등록
CVE-2026-53595
freescout-help-desk freescout 취약점
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint `POST /user-setup/{hash}/{invite_sent_at}` (`OpenController@userSetupSave`) selects the target account solely by its `invite_hash` column, then overwrites that account's email and password and logs in as it. No authentication, cookie, or prior session is required. After a user activates, FreeScout sets `invite_hash` to the empty string. On MySQL and MariaDB, `VARCHAR` equality ignores trailing spaces, so a single URL-encoded space (`%20`) matches the stored empty...
- 대응 우선순위
- 점검
- CVSS
- 9.4
- EPSS
- 0.37% 백분위 30.1% · 2026.07.29 기준
- CISA KEV
- 미등록
- 조치 기한
- -
- 공개일
- 2026.07.21